---
title: "Security digest: March 7, 2024"
url: https://erroneo.us/security/2024-03-07/
description: "March 7, 2024 vulnerability digest: 1 CISA KEV addition (JetBrains); 3 critical advisories (PyPI). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2024-03-07
date_modified: 2024-03-07
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 7, 2024

1 known exploited (cisa kev) addition and 3 critical advisories.

## Take stock

- Do you run any of these? JetBrains TeamCity. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-03-28.
- PyPI: 3 critical advisories ( pgAdmin4 , paddlepaddle ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2024-27198](https://erroneo.us/security/cve/CVE-2024-27198/index.md) JetBrains TeamCity: JetBrains TeamCity Authentication Bypass Vulnerability (CISA due 2024-03-28)

## Critical advisories

- [CVE-2024-2044](https://erroneo.us/security/cve/CVE-2024-2044/index.md) pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user — PyPI pgAdmin4 < 8.4 → 8.4
- [CVE-2024-0917](https://erroneo.us/security/cve/CVE-2024-0917/index.md) PaddlePaddle vulnerable to remote code execution — PyPI paddlepaddle <= 2.6.0 → no fix
- [CVE-2024-0818](https://erroneo.us/security/cve/CVE-2024-0818/index.md) PaddlePaddle Path Traversal vulnerability — PyPI paddlepaddle <= 2.6.0 → no fix

---
Source page: https://erroneo.us/security/2024-03-07/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt